Bug #69149 [Com]: The PCRE extension crashes seeminglessly due to memory leaks or double free

Edit report at https://bugs.php.net/bug.php?id=69149&edit=1 ID: 69149 Comment by: hzmester at freemail dot hu Reported by: gregory at luni dot fr Summary: The PCRE extension crashes seeminglessly due to memory leaks or double free Status: Verified Type: Bug Package: *Regular Expressions Operating System: OSX, Linux PHP Version: master-Git-2015-02-28 (Git) Block user comment: N Private report: N New Comment: This is a valid bug and related to the alternative compiling again, but with recursion. E.g: /(?:a|b|c|d|e)(?R)/ I try to fix it soon. Thank you for finding it. Previous Comments: ------------------------------------------------------------------------ [2015-03-04 11:09:23] gregory at luni dot fr This is what the php7 -i command returns about PCRE : pcre PCRE (Perl Compatible Regular Expressions) Support => enabled PCRE Library Version => 8.36 2014-09-26 PCRE JIT Support => enabled Directive => Local Value => Master Value pcre.backtrack_limit => 1000000 => 1000000 pcre.jit => 1 => 1 pcre.recursion_limit => 100000 => 100000 The version is 8.36, maybe this bug wasn't fixed since 8.35. ------------------------------------------------------------------------ [2015-03-04 07:37:39] hzmester at freemail dot hu Which pcre version? As far as I remember 8.35 has an alternative compiling bug. ------------------------------------------------------------------------ [2015-03-01 15:27:29] laruence@php.net seems it's a bug in pcrelib .. anyway, must related to pcre jit we introduced recently. php -d pcre.jit=0 runs fine.. ==6629== Invalid write of size 8 ==6629== at 0x4DEDE6: _pcre_jit_compile (pcre_jit_compile.c:10313) ==6629== by 0x4B532E: php_pcre_study (pcre_study.c:1585) ==6629== by 0x4E440D: pcre_get_compiled_regex_cache (php_pcre.c:420) ==6629== by 0x4E4F46: php_do_pcre_match (php_pcre.c:570) ==6629== by 0x4E6861: zif_preg_match (php_pcre.c:904) ==6629== by 0xA86BE2: ZEND_DO_ICALL_SPEC_HANDLER (zend_vm_execute.h:511) ==6629== by 0xA863E8: execute_ex (zend_vm_execute.h:352) ==6629== by 0xA86543: zend_execute (zend_vm_execute.h:381) ==6629== by 0xA36775: zend_execute_scripts (zend.c:1282) ==6629== by 0x9A8220: php_execute_script (main.c:2527) ==6629== by 0xAE349D: do_cli (php_cli.c:979) ==6629== by 0xAE452E: main (php_cli.c:1355) ==6629== Address 0x11a2bc88 is 24 bytes before a block of size 120 alloc'd ==6629== at 0x4A078B8: malloc (vg_replace_malloc.c:270) ==6629== by 0x4B701C: sljit_create_compiler (sljitLir.c:335) ==6629== by 0x4DD55B: _pcre_jit_compile (pcre_jit_compile.c:9964) ==6629== by 0x4B532E: php_pcre_study (pcre_study.c:1585) ==6629== by 0x4E440D: pcre_get_compiled_regex_cache (php_pcre.c:420) ==6629== by 0x4E4F46: php_do_pcre_match (php_pcre.c:570) ==6629== by 0x4E6861: zif_preg_match (php_pcre.c:904) ==6629== by 0xA86BE2: ZEND_DO_ICALL_SPEC_HANDLER (zend_vm_execute.h:511) ==6629== by 0xA863E8: execute_ex (zend_vm_execute.h:352) ==6629== by 0xA86543: zend_execute (zend_vm_execute.h:381) ==6629== by 0xA36775: zend_execute_scripts (zend.c:1282) ==6629== by 0x9A8220: php_execute_script (main.c:2527) ------------------------------------------------------------------------ [2015-03-01 00:15:44] gregory at luni dot fr the error does not occur with this similar regex : /(?:(?:public|protected|private)\s+)(?:(?:final|abstract|static)\s+)?\s+function\s+test\([^\)]*\)\s*(?:\{(?:[^{}]*|(?R))*\})/sm ------------------------------------------------------------------------ [2015-02-28 23:49:37] gregory at luni dot fr Added backtrace : (gdb) backtrace #0 0x00007fff9b897286 in __pthread_kill () from /usr/lib/system/libsystem_kernel.dylib #1 0x00007fff9631942f in pthread_kill () from /usr/lib/system/libsystem_pthread.dylib #2 0x00007fff8d8d3b53 in abort () from /usr/lib/system/libsystem_c.dylib #3 0x00007fff8d89bc39 in __assert_rtn () from /usr/lib/system/libsystem_c.dylib #4 0x000000010071c97c in zend_function_dtor (zv=0x7fff5fbfe058) at Zend/zend_opcode.c:122 #5 0x000000010074b680 in _zend_hash_del_el_ex (ht=0x101413a70, idx=1462, p=0x101854ac0, prev=0x0) at Zend/zend_hash.c:845 #6 0x000000010074cb69 in _zend_hash_del_el (ht=0x101413a70, idx=1462, p=0x101854ac0) at Zend/zend_hash.c:869 #7 0x000000010074d33c in zend_hash_reverse_apply (ht=0x101413a70, apply_func=0x1007151a0 <clean_non_persistent_function>) at Zend/zend_hash.c:1384 #8 0x0000000100714e59 in shutdown_executor () at Zend/zend_execute_API.c:345 #9 0x000000010073349e in zend_deactivate () at Zend/zend.c:890 #10 0x00000001006823d2 in php_request_shutdown (dummy=0x0) at main/main.c:1850 #11 0x00000001007fe1be in do_cli (argc=2, argv=0x101413760) at sapi/cli/php_cli.c:1156 #12 0x00000001007fc313 in main (argc=2, argv=0x101413760) at sapi/cli/php_cli.c:1355 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=69149 -- Edit this bug report at https://bugs.php.net/bug.php?id=69149&edit=1